I should do better than this, but my flight to SF takes off in just over an hour, so for now: the first paper this article linked to (I wrote it with Tim Newsham) is a study in how you can compare implementation details between two TCP/IP stacks and use them to sneak traffic past a middlebox that assumes one interpretation or the other. The example that comes to mind is putting data in a TCP SYN segment.